[kernel-sec-discuss] r3442 - active retired
Moritz Muehlenhoff
jmm at moszumanska.debian.org
Mon Jul 14 10:16:14 UTC 2014
Author: jmm
Date: 2014-07-14 10:16:14 +0000 (Mon, 14 Jul 2014)
New Revision: 3442
Added:
retired/CVE-2014-0203
retired/CVE-2014-2678
retired/CVE-2014-3122
retired/CVE-2014-3144
retired/CVE-2014-3145
retired/CVE-2014-4656
Removed:
active/CVE-2014-0203
active/CVE-2014-2678
active/CVE-2014-3122
active/CVE-2014-3144
active/CVE-2014-3145
active/CVE-2014-4656
Log:
retire issues which have been submitted to 2.6.32.x LTS and which are fixed in
all other suites, 2.6.32.x releases at much slower pace, no need to wait here
Deleted: active/CVE-2014-0203
===================================================================
--- active/CVE-2014-0203 2014-07-14 10:12:18 UTC (rev 3441)
+++ active/CVE-2014-0203 2014-07-14 10:16:14 UTC (rev 3442)
@@ -1,10 +0,0 @@
-Description: SLAB corruption in do_filp_open()
-References:
-Notes:
-Bugs:
-upstream: released (2.6.33-rc4) [86acdca1b63e6890540fa19495cfc708beff3d8b]
-2.6.32-upstream-stable: pending (2.6.32.64)
-sid: released (2.6.33-1~experimental.5)
-3.2-wheezy-security: N/A
-2.6.32-squeeze-security: released (2.6.32-48squeeze8)
-3.2-upstream-stable: N/A
Deleted: active/CVE-2014-2678
===================================================================
--- active/CVE-2014-2678 2014-07-14 10:12:18 UTC (rev 3441)
+++ active/CVE-2014-2678 2014-07-14 10:16:14 UTC (rev 3442)
@@ -1,11 +0,0 @@
-Description: rds: prevent dereference of a NULL device in rds_iw_laddr_check
-References:
- https://lkml.org/lkml/2014/3/29/188
-Notes:
-Bugs:
-upstream: released (3.15-rc1) [bf39b4247b8799935ea91d90db250ab608a58e50]
-2.6.32-upstream-stable: pending (2.6.32.64)
-sid: released (3.13.10-1)
-3.2-wheezy-security: released (3.2.57-1) [bugfix/all/rds-prevent-dereference-of-a-null-device-in-rds_iw_laddr_check.patch]
-2.6.32-squeeze-security: released (2.6.32-48squeeze8)
-3.2-upstream-stable: released (3.2.58) [rds-prevent-dereference-of-a-null-device-in-rds_iw_laddr_check.patch]
Deleted: active/CVE-2014-3122
===================================================================
--- active/CVE-2014-3122 2014-07-14 10:12:18 UTC (rev 3441)
+++ active/CVE-2014-3122 2014-07-14 10:16:14 UTC (rev 3442)
@@ -1,10 +0,0 @@
-Description: DoS in memory management
-References:
-Notes:
-Bugs: 747326
-upstream: released (3.15-rc1) [57e68e9cd65b4b8eb4045a1e0d0746458502554c]
-2.6.32-upstream-stable: pending (2.6.32.64)
-sid: released (3.14.4-1)
-3.2-wheezy-security: released (3.2.57-3+deb7u1) [bugfix/all/mm-try_to_unmap_cluster-should-lock_page-before-mloc.patch]
-2.6.32-squeeze-security: released (2.6.32-48squeeze8)
-3.2-upstream-stable: released (3.2.58)
Deleted: active/CVE-2014-3144
===================================================================
--- active/CVE-2014-3144 2014-07-14 10:12:18 UTC (rev 3441)
+++ active/CVE-2014-3144 2014-07-14 10:16:14 UTC (rev 3442)
@@ -1,14 +0,0 @@
-Description: The BPF_S_ANC_NLATTR and BPF_S_ANC_NLATTR_NEST extensions fail to check for a minimal message length
-References:
- http://www.openwall.com/lists/oss-security/2014/05/09/5
-Notes:
- Thought to be fixed in 3.14.4-1 by patch
- bugfix/all/filter-prevent-nla-extensions-to-peek-beyond-the-end.patch,
- but two hunks are applied in the same place so the bug is only half-fixed.
-Bugs:
-upstream: released (v3.15-rc2) [05ab8f2647e4221cbdb3856dd7d32bd5407316b3]
-2.6.32-upstream-stable: pending (2.6.32.64)
-sid: released (3.14.5-1)
-3.2-wheezy-security: released (3.2.57-3+deb7u2) [bugfix/all/filter-prevent-nla-extensions-to-peek-beyond-the-end.patch]
-2.6.32-squeeze-security: released (2.6.32-48squeeze8)
-3.2-upstream-stable: released (3.2.60)
Deleted: active/CVE-2014-3145
===================================================================
--- active/CVE-2014-3145 2014-07-14 10:12:18 UTC (rev 3441)
+++ active/CVE-2014-3145 2014-07-14 10:16:14 UTC (rev 3442)
@@ -1,11 +0,0 @@
-Description: The remainder calculation for the BPF_S_ANC_NLATTR_NEST extension is also wrong. It has the minuend and subtrahend mixed up
-References:
- http://www.openwall.com/lists/oss-security/2014/05/09/5
-Notes:
-Bugs:
-upstream: released (v3.15-rc2) [05ab8f2647e4221cbdb3856dd7d32bd5407316b3]
-2.6.32-upstream-stable: pending (2.6.32.64)
-sid: released (3.14.4-1) [bugfix/all/filter-prevent-nla-extensions-to-peek-beyond-the-end.patch]
-3.2-wheezy-security: released (3.2.57-3+deb7u2) [bugfix/all/filter-prevent-nla-extensions-to-peek-beyond-the-end.patch]
-2.6.32-squeeze-security: released (2.6.32-48squeeze8)
-3.2-upstream-stable: released (3.2.60)
Deleted: active/CVE-2014-4656
===================================================================
--- active/CVE-2014-4656 2014-07-14 10:12:18 UTC (rev 3441)
+++ active/CVE-2014-4656 2014-07-14 10:16:14 UTC (rev 3442)
@@ -1,10 +0,0 @@
-Description: ALSA user controls integer overflows
-References:
-Notes:
-Bugs:
-upstream: released (3.16-rc2) [883a1d49f0d77d30012f114b2e19fc141beb3e8e, ac902c112d90a89e59916f751c2745f4dbdbb4bd]
-2.6.32-upstream-stable: pending (2.6.32.64)
-sid: released (3.14.9-1)
-3.2-wheezy-security: released (3.2.60-1) [bugfix/all/ALSA-control-Make-sure-that-id-index-does-not-overfl.patch, bugfix/all/ALSA-control-Handle-numid-overflow.patch]
-2.6.32-squeeze-security: released (2.6.32-48squeeze8)
-3.2-upstream-stable: released (3.2.61) [alsa-control-make-sure-that-id-index-does-not-overflow.patch, alsa-control-handle-numid-overflow.patch]
Copied: retired/CVE-2014-0203 (from rev 3439, active/CVE-2014-0203)
===================================================================
--- retired/CVE-2014-0203 (rev 0)
+++ retired/CVE-2014-0203 2014-07-14 10:16:14 UTC (rev 3442)
@@ -0,0 +1,10 @@
+Description: SLAB corruption in do_filp_open()
+References:
+Notes:
+Bugs:
+upstream: released (2.6.33-rc4) [86acdca1b63e6890540fa19495cfc708beff3d8b]
+2.6.32-upstream-stable: pending (2.6.32.64)
+sid: released (2.6.33-1~experimental.5)
+3.2-wheezy-security: N/A
+2.6.32-squeeze-security: released (2.6.32-48squeeze8)
+3.2-upstream-stable: N/A
Property changes on: retired/CVE-2014-0203
___________________________________________________________________
Added: svn:mergeinfo
+
Copied: retired/CVE-2014-2678 (from rev 3439, active/CVE-2014-2678)
===================================================================
--- retired/CVE-2014-2678 (rev 0)
+++ retired/CVE-2014-2678 2014-07-14 10:16:14 UTC (rev 3442)
@@ -0,0 +1,11 @@
+Description: rds: prevent dereference of a NULL device in rds_iw_laddr_check
+References:
+ https://lkml.org/lkml/2014/3/29/188
+Notes:
+Bugs:
+upstream: released (3.15-rc1) [bf39b4247b8799935ea91d90db250ab608a58e50]
+2.6.32-upstream-stable: pending (2.6.32.64)
+sid: released (3.13.10-1)
+3.2-wheezy-security: released (3.2.57-1) [bugfix/all/rds-prevent-dereference-of-a-null-device-in-rds_iw_laddr_check.patch]
+2.6.32-squeeze-security: released (2.6.32-48squeeze8)
+3.2-upstream-stable: released (3.2.58) [rds-prevent-dereference-of-a-null-device-in-rds_iw_laddr_check.patch]
Property changes on: retired/CVE-2014-2678
___________________________________________________________________
Added: svn:mergeinfo
+
Copied: retired/CVE-2014-3122 (from rev 3439, active/CVE-2014-3122)
===================================================================
--- retired/CVE-2014-3122 (rev 0)
+++ retired/CVE-2014-3122 2014-07-14 10:16:14 UTC (rev 3442)
@@ -0,0 +1,10 @@
+Description: DoS in memory management
+References:
+Notes:
+Bugs: 747326
+upstream: released (3.15-rc1) [57e68e9cd65b4b8eb4045a1e0d0746458502554c]
+2.6.32-upstream-stable: pending (2.6.32.64)
+sid: released (3.14.4-1)
+3.2-wheezy-security: released (3.2.57-3+deb7u1) [bugfix/all/mm-try_to_unmap_cluster-should-lock_page-before-mloc.patch]
+2.6.32-squeeze-security: released (2.6.32-48squeeze8)
+3.2-upstream-stable: released (3.2.58)
Property changes on: retired/CVE-2014-3122
___________________________________________________________________
Added: svn:mergeinfo
+
Copied: retired/CVE-2014-3144 (from rev 3439, active/CVE-2014-3144)
===================================================================
--- retired/CVE-2014-3144 (rev 0)
+++ retired/CVE-2014-3144 2014-07-14 10:16:14 UTC (rev 3442)
@@ -0,0 +1,14 @@
+Description: The BPF_S_ANC_NLATTR and BPF_S_ANC_NLATTR_NEST extensions fail to check for a minimal message length
+References:
+ http://www.openwall.com/lists/oss-security/2014/05/09/5
+Notes:
+ Thought to be fixed in 3.14.4-1 by patch
+ bugfix/all/filter-prevent-nla-extensions-to-peek-beyond-the-end.patch,
+ but two hunks are applied in the same place so the bug is only half-fixed.
+Bugs:
+upstream: released (v3.15-rc2) [05ab8f2647e4221cbdb3856dd7d32bd5407316b3]
+2.6.32-upstream-stable: pending (2.6.32.64)
+sid: released (3.14.5-1)
+3.2-wheezy-security: released (3.2.57-3+deb7u2) [bugfix/all/filter-prevent-nla-extensions-to-peek-beyond-the-end.patch]
+2.6.32-squeeze-security: released (2.6.32-48squeeze8)
+3.2-upstream-stable: released (3.2.60)
Property changes on: retired/CVE-2014-3144
___________________________________________________________________
Added: svn:mergeinfo
+
Copied: retired/CVE-2014-3145 (from rev 3439, active/CVE-2014-3145)
===================================================================
--- retired/CVE-2014-3145 (rev 0)
+++ retired/CVE-2014-3145 2014-07-14 10:16:14 UTC (rev 3442)
@@ -0,0 +1,11 @@
+Description: The remainder calculation for the BPF_S_ANC_NLATTR_NEST extension is also wrong. It has the minuend and subtrahend mixed up
+References:
+ http://www.openwall.com/lists/oss-security/2014/05/09/5
+Notes:
+Bugs:
+upstream: released (v3.15-rc2) [05ab8f2647e4221cbdb3856dd7d32bd5407316b3]
+2.6.32-upstream-stable: pending (2.6.32.64)
+sid: released (3.14.4-1) [bugfix/all/filter-prevent-nla-extensions-to-peek-beyond-the-end.patch]
+3.2-wheezy-security: released (3.2.57-3+deb7u2) [bugfix/all/filter-prevent-nla-extensions-to-peek-beyond-the-end.patch]
+2.6.32-squeeze-security: released (2.6.32-48squeeze8)
+3.2-upstream-stable: released (3.2.60)
Property changes on: retired/CVE-2014-3145
___________________________________________________________________
Added: svn:mergeinfo
+
Copied: retired/CVE-2014-4656 (from rev 3439, active/CVE-2014-4656)
===================================================================
--- retired/CVE-2014-4656 (rev 0)
+++ retired/CVE-2014-4656 2014-07-14 10:16:14 UTC (rev 3442)
@@ -0,0 +1,10 @@
+Description: ALSA user controls integer overflows
+References:
+Notes:
+Bugs:
+upstream: released (3.16-rc2) [883a1d49f0d77d30012f114b2e19fc141beb3e8e, ac902c112d90a89e59916f751c2745f4dbdbb4bd]
+2.6.32-upstream-stable: pending (2.6.32.64)
+sid: released (3.14.9-1)
+3.2-wheezy-security: released (3.2.60-1) [bugfix/all/ALSA-control-Make-sure-that-id-index-does-not-overfl.patch, bugfix/all/ALSA-control-Handle-numid-overflow.patch]
+2.6.32-squeeze-security: released (2.6.32-48squeeze8)
+3.2-upstream-stable: released (3.2.61) [alsa-control-make-sure-that-id-index-does-not-overflow.patch, alsa-control-handle-numid-overflow.patch]
Property changes on: retired/CVE-2014-4656
___________________________________________________________________
Added: svn:mergeinfo
+
More information about the kernel-sec-discuss
mailing list